Cybersecurity Executive Dashboard

The Cybersecurity Executive Dashboard is a comprehensive solution that provides high-level executive officers visibility into an organization's security posture, policies, and initiatives.

The Cybersecurity Executive Dashboard application [sn_bod] is available in the ServiceNow® Store. See the dependencies and system requirements that are required for the application on the listing in the ServiceNow® Store.

The Cybersecurity Executive Dashboard provides high-level executive officers comprehensive insights into their organization's security posture. The dashboard integrates data from all products in the Security Operations product suite, including Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, Configuration Compliance, Security Incident Response, and Major Security Incident Management. Additionally, it incorporates employee readiness data by seamlessly integrating with leading third-party phishing simulation tools such as KnowBe4 and Microsoft Defender for Office365.

The personas the dashboard might support in your organization includes but is not limited to:

• Chief Risk Officers (CRO)
• Chief Information Officers (CIO)
• Chief Privacy Officers (CPO)
• Chief Executive Officers (CEO)
• Members of the Board of Directors, Audit Committees, outside counsel and other executives.

The dashboard provides the following features:

• Consolidates data from various applications into a single view of your organization's overall security posture that includes vulnerabilities, configuration compliance, security incidents, and employee readiness.
• Aggregated view of security metrics from various Security Operations products.
• Organization-wide security posture scoring.
• Business unit-specific risk assessments and a pinning feature for prioritizing top business units.
• Customizable dashboard for personalized monitoring.
• Integration with third-party tools for phishing simulation data (KnowBe4 and Microsoft Defender for Office365).
• Target setting and KPI tracking capabilities.
• Peer benchmarking.

These features enable proactive decision making by providing your organization with quick access to critical security metrics, which makes the dashboard an indispensable tool for enhancing overall security resilience and readiness.

Required ServiceNow AI Platform roles

• System admin (admin) for installation of applications.
• CISO User (sn_bod.ciso) for read access of the Unified CISO Dashboard.
• CISO admin (sn_bod.ciso_admin) to view, share the dashboard, configure weights for security posture rating.
• GRC CISO User (sn_grc_dashboards.grc_ciso_user) to view risk and compliance reports.

Access the Cybersecurity Executive Dashboard

To open the dashboard, navigate to All > Cybersecurity Executive Dashboard > Cybersecurity Executive Dashboard.

Data visualization

Note: To learn more about a widget, select the information icon

Indicators

• Host SLA – Closed

  This indicator is calculated daily. It considers the total age of all host vulnerabilities that were closed on the previous day at the time of calculation.

• Container SLA – Closed

  This indicator is calculated daily. It considers all the container vulnerabilities that were closed on the previous day at the time of calculation.

• Application SLA – Closed

  This indicator is calculated daily. It considers the total age of all the application vulnerabilities that were closed on the previous day at the time of calculation.

• Test Result SLA – Passed

  This indicator is calculated daily. It considers all the test result vulnerabilities that were passed on the previous day at the time of calculation.

• Host SLA - Closed Count

  This indicator is calculated daily. It considers the count of all host vulnerabilities that were closed on the previous day at the time of calculation.

• Container SLA - Closed Count

  This indicator is calculated daily. It considers the count of all container vulnerabilities that were closed on the previous day at the time of calculation.

• Application SLA - Closed Count

  This indicator is calculated daily. It considers the count of all application vulnerabilities that were closed on the previous day at the time of calculation.

• Test Result SLA – Passed Count

  This indicator is measured daily. It considers the count of all test result vulnerabilities that were last passed on the previous day at the time of calculation.

• Scanned Assets

  This indicator is calculated daily. It considers the sum of scanned CIs from the sn_vul_analytics_scan_coverage_config table, which includes those last scanned within the past 90 days, across all CMDB CI Classes.

• Scannable Assets

  This indicator is calculated daily. It considers the sum of total CIs from sn_vul_analytics_scan_coverage_config table for all the CMDB CI Classes present.

• Vulnerable Items

  This indicator is calculated daily. It considers the count of active vulnerable items at the time of calculation.

• Application Vulnerable Item

  This indicator is calculated daily. It considers the count of active application vulnerable items at the time of calculation.

• Container Vulnerable Item

  This indicator is calculated daily. It considers the count of active container vulnerable items at the time of calculation.

• Summed Age of Vulnerable Items

  This indicator is calculated daily. It considers the summed age of active vulnerable items at the time of calculation.

• Summed Age of Application Vulnerable Items

  This indicator is calculated daily. It considers the summed age of active application vulnerable items at the time of calculation.

• Open Vulnerable Items

  This indicator is calculated daily. It considers the open vulnerable items at the time of calculation.

• Open Container Vulnerable Items

  This indicator is calculated daily. It considers the open container vulnerable items at the time of calculation.

• Open Application Vulnerable Items

  This indicator is calculated daily. It considers the open application vulnerable items at the time of calculation.

• Active Test Results

  This indicator is calculated daily. It considers the open test results at the time of calculation.

• Deferred VITs

  This indicator is calculated daily. It has an indicator source as host vulnerable item.

• Deferred AVITs

  This indicator is calculated daily. It has an indicator source as an application vulnerable item.

• Deferred CVITs

  This indicator is calculated daily. It has an indicator source as a container vulnerable item.

• Deferred Test Results

  This indicator is calculated daily. It considers the test results that were in a deferred state.

• Open Config Issues - Test results

  This indicator is calculated daily. It has an indicator source as a test result for the Unified Vulnerability Response Dashboard.

• SI-Average Time To Identify

  This indicator is calculated daily. It considers the security incident where definition is time to identify at the time of calculation.

• SI - Average Duration Time

  This indicator is calculated daily. It considers the security incident where the definition is an incident state duration at the time of calculation.

• Number of Open Major Security Incidents

  This indicator is calculated daily. It considers open major security incidents at the time of calculation.

• Number of closed security incidents

  This indicator is calculated daily. It considers closed security incidents at the time of calculation.

• Closed Application Vulnerable Items

  This indicator is calculated daily. It considers closed application vulnerable items at the time of calculation.

• Closed Container Vulnerable Items

  This indicator is calculated daily. It considers closed container vulnerable items at the time of calculation.

• Closed Vulnerable Items

  This indicator is calculated daily. It considers closed vulnerable items at the time of calculation.

• Get Max Risk Score for Vulnerable Items

  This indicator is calculated daily. It considers the maximum risk score for vulnerable items at the time of calculation.

• Get Max Risk Score for Container Vulnerable Item

  This indicator is calculated daily. It considers the maximum risk score for container vulnerable items at the time of calculation.

• Get Max Risk Score for Application Vulnerable Items

  This indicator is calculated daily. It considers the max risk score for application vulnerable items at the time of calculation.

• Summed Risk Score of VITs

  This indicator is calculated daily. It considers the sum of risk scores of vulnerable items at the time of calculation.

• Summed Risk Score of AVIs

  This indicator is calculated daily. It considers the sum of risk scores of application vulnerable items at the time of calculation.

• Summed Risk Score of CVIs

  This indicator is calculated daily. It considers the sum of risk scores of container vulnerable items at the time of calculation.

• Summed Risk Score of Misconfigurations

  This indicator is calculated daily. It considers the sum of risk scores of test results at the time of calculation.

• Get Max Risk Score for SI Incidents

  This indicator is calculated daily. It considers the max risk scores of security incidents at the time of calculation.

• Get Max Risk Score for Misconfigurations Test Results

  This indicator is calculated daily. It considers the maximum risk scores for misconfiguration of test results at the time of calculation.

• Get Avg Risk Score for Misconfiguration Test Results

  This indicator is calculated daily. It considers the average risk scores for misconfiguration of test results at the time of calculation.

• Number of open security incidents

  This indicator is calculated daily. It considers open security incidents at the time of calculation.

• Phishing Overview

  This indicator is calculated daily. It considers the count of Security Simulation Metrics at the time of calculation.

• Aggregate MTTR

  Calculates the average time taken to close vulnerabilities (hosts, containers, and applications) and the time taken to close the test results in days. [[Host SLA - Closed]] + [[Application SLA - Closed]] + [[Container SLA - Closed]] + [[Test Result SLA - Passed]]) / ([[Host SLA - Closed Count]] + [[Application SLA - Closed Count]] + [[Test Result SLA - Passed Count]] + [[Container SLA - Closed Count]])

• Current Scan Coverage

  Calculates the percentage by utilizing the ratio between the number of items scanned and the total number of items eligible for scanning during the same period. var scannedItems =[[Scanned Assets]];var scannableItems = [[Scannable Assets]];var res;if (scannedItems == 0)res = 0;elseres = scannedItems / scannableItems * 100;if (res > 100)res = 100;res;

• Average Age of Active Vulnerable Items

  Calculates the average age of all active vulnerable items (hosts, containers, and applications) in days. ([[Summed Age of Vulnerable Items]] + [[Summed Age of Application Vulnerable Items]] + [[Summed Age of Container Vulnerable Items]]) / ([[Vulnerable Items]] + [[Application Vulnerable Items]] + [[Container Vulnerable Items]])

• Active VITs by age and risk rating

  Calculates the total count of all active vulnerable items (hosts, containers, and applications) categorized by their age and level of risk assessment. [[Open Vulnerable Items]] + [[Open Container Vulnerable Items]] + [[Open Application Vulnerable Items]]

• Deferred Issues

  Calculates the total count of all vulnerable items (hosts, containers, applications, and test results) with the state as 'Deferred'. [[Deferred VITs]] + [[Deferred AVITs]] + [[Deferred Test Results]] + [[Deferred CVITs]]

• Average resolution time of closed security incidents

  Calculates the average time taken to close the security incidents in days. ([[Summed duration of closed security incidents]] / [[Number of closed security incidents]]) /24

• Security Score

  Calculates the overall security ratings daily. It’s calculated based on the rolled up risk score. var secPostureRating = 100 - [[Security score]]; secPostureRating;

• Security Score (Business Units)

  Calculates the final rolled up risk score where the roll-up risk score of vulnerable items, misconfigurations, security incidents, and major security incidents are multiplied with the respective weights that are fetched from the security posture roll-up table. var numMajorIncidents = [[Number of Open Major Security Incidents]], majorSIRiskScore, rollUpRiskScore; if(numMajorIncidents > 0) majorSIRiskScore = 100; else majorSIRiskScore = 0; rollUpRiskScore = ([[Vulnerability and Misconfiguration Rolled up Risk Score]] * 20 + [[OT Vulnerability Rolled up Risk Score]] * 20 + [[Get Max Risk Score for SI Incidents]] * 20 + majorSIRiskScore * 40)/100; rollUpRiskScore;

• Security Score (Business Services)

  Calculates the final rolled up risk score where the roll-up risk score of vulnerable items, misconfigurations, security incidents, and major security incidents are multiplied with the respective weights that are fetched from the security posture roll-up table. var numMajorIncidents = [[Number of Open Major Security Incidents - Services]], majorSIRiskScore, rollUpRiskScore; if(numMajorIncidents > 0) majorSIRiskScore = 100; else majorSIRiskScore = 0; rollUpRiskScore = ([[Vulnerability and Misconfiguration Rolled up Risk Score - Services]] * 20 + [[OT Vulnerability Rolled up Risk Score - Services]] * 20 + [[Get Max Risk Score for SI Incidents - Services]] * 20 + majorSIRiskScore * 40)/100; rollUpRiskScore;

• Vulnerability Rolled up Risk Score

  Calculates the vulnerability rolled up risk score where the max risk score, average risk score of vulnerable items and count of vulnerable items are multiplied with their respective weights. var maxRiskScore = 100; var count = [[Active VITs by age and risk rating]]; var countRiskScore; if (0 == count) countRiskScore = 0; else if (count > 10000) countRiskScore = maxRiskScore; else if (count > 1000) countRiskScore = (maxRiskScore * 0.80); else if (count > 100) countRiskScore = (maxRiskScore * 0.60); else if (count > 10) countRiskScore = (maxRiskScore * 0.40); else countRiskScore = (maxRiskScore * 0.20); var vulRiskScore = ([[Get Max Score form all Vulnerable Items]] * 0 + [[Average Risk Score of all Vulnerable Items]] * 100 + countRiskScore * 0)/100; vulRiskScore;

• Get Max Score from all Vulnerable Items

  Calculates the vulnerability rolled up risk score where the max risk score, average risk score of vulnerable items and count of vulnerable items are multiplied with their respective weights. var maxScoreForVI = [[Get Max Risk Score for Vulnerable Items]], maxScoreForCVI = [[Get Max Risk Score for Container Vulnerable Item]], maxScoreForAVI = [[Get Max Risk Score for Application Vulnerable Items]], maxScore; if (maxScoreForVI >= maxScoreForCVI && maxScoreForVI >= maxScoreForAVI) maxScore = maxScoreForVI; else if (maxScoreForCVI >= maxScoreForVI && maxScoreForCVI >= maxScoreForAVI ) maxScore = maxScoreForCVI; else maxScore = maxScoreForAVI; maxScore;

• Average Risk Score of all Vulnerable Items

  Calculates the average risk score from all vulnerable items (hosts, containers, and applications). var summedRiskScore = [[Summed Risk Score of VITs]] + [[Summed Risk Score of AVIs]] + [[Summed Risk Score of CVIs]], avgRiskScore; var totalVulCount = [[Open Vulnerable Items]] + [[Open Application Vulnerable Items]] + [[Open Container Vulnerable Items]]; if(summedRiskScore == 0) avgRiskScore = 0; else if(totalVulCount .=0 ) avgRiskScore = summedRiskScore / totalVulCount; avgRiskScore;

• Misconfiguration Rolled up Risk Score

  Calculates the misconfiguration rolled up risk score using the test outcomes categorized as Failed, Error, or Unknown. var maxRiskScore = 100; var count = [[Open Config Issues - Test results]]; var countRiskScore; if (0 == count) countRiskScore = 0; else if (count > 10000) countRiskScore = maxRiskScore; else if (count > 1000) countRiskScore = (maxRiskScore * 0.80); else if (count > 100) countRiskScore = (maxRiskScore * 0.60); else if (count > 10) countRiskScore = (maxRiskScore * 0.40); else countRiskScore = (maxRiskScore * 0.20); var misRiskScore = ([[Get Max Risk Score for Misconfigurations Test Results]] * 0 + [[Get Avg Risk Score for Misconfiguration test results]] * 100 + countRiskScore * 0)/100; misRiskScore;

• Average Time to Eradicate

  Calculates the average time taken to eradicate security incidents in days [[SI - Average Duration Time > Security Incident State = Eradicate]] / 1440

• Average Time to Identify

  Calculates the average time taken to identify security incidents in days. [[SI - Average Time To Identify]] / 1440

• Average Time to Contain

  Calculates the average time taken to contain security incidents in days. [[SI - Average Duration Time > Security Incident State = Contain]] / 1440

• Remediation Target Adherence

  Calculates the monthly percentage of remediation target adherence from test results, vulnerable items, container vulnerable items, and application vulnerable items. The target adherence is determined by the number of items that have fulfilled the set target. ([[Test Result SLA - Passed Count > Remediation status (unified) = Target Met]] + [[Container SLA - Closed Count > Remediation status (unified) = Target Met]] + [[Application SLA - Closed Count > Remediation status (unified) = Target Met]] + [[Host SLA - Closed Count > Remediation status (unified) = Target Met]]) / ([[Test Result SLA - Passed Count]] + [[Container SLA - Closed Count]] + [[Application SLA - Closed Count]] + [[Host SLA - Closed Count]]) * 100

• Monthly Remediation Efficiency (All Vulnerable Items)

  Calculates the monthly percentage of closed vulnerable items, containers vulnerable items, and application vulnerable items in contrast to newly identified ones. var closedItems = [[Host SLA - Closed Count]] + [[Container SLA - Closed Count]] + [[Application SLA - Closed Count]] + [[Test Result SLA - Passed Count]];

  var newItems = [[Host VITs opened/reopened yesterday]] + [[Container VITs opened/reopened yesterday]] + [[Application VITs opened/reopened yesterday]] + [[Test results opened/reopened yesterday]];

  var res = 0;if (closedItems == 0) res = 0;else if (newItems .=0)res = closedItems / newItems * 100;if (res > 1000) res = 1000; res;

• Host VITs opened/reopened yesterday

  This indicator is calculated daily. It considers the host vulnerable items that were last opened on the previous day at the time of calculation.

• Application VITs opened/reopened yesterday

  This indicator is calculated daily. It considers the application vulnerable items that were last opened on the previous day at the time of calculation.

• Container VITs opened/reopened yesterday

  This indicator is calculated daily. It considers the container vulnerable items that were last opened on the previous day at the time of calculation.

• Test results opened/reopened yesterday

  This indicator is calculated daily. It considers the test results that were last seen on the previous day at the time of calculation.

• OT Vulnerable Items

  This indicator is calculated daily. It considers active OT vulnerable items present at the time of calculation.

• OT Summed Duration of Closed Vulnerable

  This indicator is calculated daily. It considers the total age of all OT vulnerabilities that are closed on the day of calculation.

• OT Closed Vulnerable Items

  This indicator is calculated daily. It considers the OT vulnerable items that are closed on the day of calculation.

• Average age of OT active vulnerable items

  Calculates the average age of OT vulnerable items ([[Summed age of OT vulnerable Items]] / [[OT Vulnerable Items]])

Breakdowns

• Business Unit
• Business Services
• Risk Rating
• Age Range
• Assignment Group (unified)
• Remediation Target Status (Closed)
• Asset Class
• Asset Category
• Risk Rating (unified)
• Deferred Reason (unified)
• Security Incident State
• Security Incident Priority
• Security Incident Category
• Phishing Event
• Deferred Reason Non Closed (unified)

Applications to activate

You must activate the following applications to populate the score in the widgets. Based on the application you’re using, you must activate the dependent applications.

Scheduled jobs for data collection

The following scheduled jobs are run to collect scores on new data automatically.